From a66e5cd12c47650966e46e2574076b4e5b38e602 Mon Sep 17 00:00:00 2001 From: Marko Petzold Date: Sat, 24 Oct 2026 21:54:25 +0200 Subject: [PATCH] release-tag: callers pass secrets: inherit The release App key is a secret of the caller's release environment, and environment secrets reach a reusable workflow only through 'secrets: inherit'. Without it the token step gets an empty key. --- .github/workflows/release-tag.yml | 1 + README.md | 3 ++- templates/workflows/release.yml | 3 +++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml index 07aa30c..1369612 100644 --- a/.github/workflows/release-tag.yml +++ b/.github/workflows/release-tag.yml @@ -12,6 +12,7 @@ # # Callers grant # permissions: { contents: read } +# secrets: inherit (environment secrets reach a reusable workflow only so) name: release-tag on: diff --git a/README.md b/README.md index d78beb9..006dd81 100644 --- a/README.md +++ b/README.md @@ -138,7 +138,8 @@ release GitHub App may create `v*` tags (bypass actor of the repository's `release-tag.yml` takes its token in the repository's `release` environment: deployments from `main` only, variable `RELEASE_APP_CLIENT_ID`, secret `RELEASE_APP_PRIVATE_KEY`; the token covers the contents of that one -repository. Callers grant `contents: read` only. +repository. Callers grant `contents: read` only and pass `secrets: inherit`: +environment secrets reach a reusable workflow only that way. ## Exceptions diff --git a/templates/workflows/release.yml b/templates/workflows/release.yml index f71a5bf..7e49963 100644 --- a/templates/workflows/release.yml +++ b/templates/workflows/release.yml @@ -49,5 +49,8 @@ jobs: uses: IronFlock/workflows/.github/workflows/release-tag.yml@v1 permissions: contents: read + # The App key is a secret of the `release` environment; environment + # secrets reach a reusable workflow only through `secrets: inherit`. + secrets: inherit # zizmor: ignore[secrets-inherit] with: version-file: VERSION